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Abstract: The cryptographic protocol based on topological knot theory, recently proposed by the authors, is improved for 
what concerns the efficiency of the encoding of knot diagrams and its error robustness. The standard Dowker- 
Thistlethwaite code, based on the ordered assignment of two numbers to each crossing of a knot diagram and 
not unique for some classes of knots, is replaced by a system of eight prototiles (knot mosaics) which, once 
assembled according to a set of combinatorial rules, reproduces unambiguously any unoriented knot diagram. 
A Reed-Muller scheme is used to encode with redundancy the eight prototiles into blocks and, once the blank 
tile is added and suitably encoded, the knot diagram is turned into an N x N mosaic, uniquely associated with 
a string of length 4N 2 bits. The complexity of the knot, measured topologically by the number of crossings, is 
in turn polynomially related to the number of tiles of the associated mosaic, and for knot diagrams of higher 
complexity the mosaic encoding provides a design of the knot-based protocol which is fault-tolerant under 
random 1-bit flips. It is also argued that the knot mosaic alphabet might be used in other applications which 
require high-capacity data transmission. 



1 KNOT-BASED PROTOCOL: 
REVIEW OF THE DT CODE 

The theoretically secure protocol proposed in 
(Marzuoli & Palumbo, 201 1) is based on purely topo- 
logical knot theory. The scheme relies on the 'easy' 
problem of associating with prime knots listed in 
Knot Tables their Dowker-Thistlethwaite codes, nu- 
merical sequences which are different for inequiva- 
lent knots. Then the 'difficulty' of factorizing com- 
plex knots generated by composing prime knots is ex- 
ploited to securely encode the given message. The 
scheme combines an asymmetric public key protocol 
with symmetric private ones and is briefly reviewed 
in the Appendix. In the following two sections the 
protocol will be improved for what concerns the effi- 
ciency of the encoding of knot diagrams and its error 
robustness. 

In order to explain the DT coding used in the orig- 
inal proposal for the protocol, a few basic notions of 
topological knot theory have to be recalled (Rolfsen, 
1976). A knot K is a continuous embedding of the 
circle S l into the Euclidean 3-space R 3 . Knots can 



be oriented or unoriented, and collections of a finite 
number of interlaced knots are called links (in the 
cryptographic protocol only knots will be used). Re- 
ferring for simplicity to the unoriented case, two knots 
K\ and K2 are said to be equivalent, K\ ~ K2, if and 
only if they are (ambient) isotopic. An isotopy is a 
continuous deformation of the shape of, say, K2 C R 3 
which makes K2 identical to K\ without cutting and 
gluing back the 'closed string' K2. 

The diagram of a knot K is its projection on a 
plane R 2 C R 3 , in such a way that no point belongs 
to the projection of three segments, namely the singu- 
lar points in the diagram are only transverse double 
points. Such a projection, together with 'over' and 
'under' information at the crossing points -depicted 
in figures by breaks in the under-passing segments- is 
denoted by the same symbol K. In Knots Tables (see 
(Hoste et al., 1998) and the Knot Atlas on Wikipedia) 
standard (i.e. associated with minimal projections) 
diagrams of unoriented 'prime' knots are listed by 
increasing crossing numbers as % n , where % is the 
number of crossings and n = 1,2, .. . enumerates in 
a conventional way the knots with the same %. The 



'unknot' or trivial knot Kq is such that %(Kq) = 
and its standard projection is the circle. Recall that 
a prime knot is a non-trivial knot which cannot be 
decomposed into two or more non-trivial knots. De- 
composition is the inverse of the topological operation 
of 'composition' of knot diagrams. More precisely, 
given two knot diagrams K\ and K2, it is possible to 
draw a new knot by removing a small segment from 
each knot and then joining the four endpoints by two 
new arcs. The resulting diagram is their connected 
sum, denoted by K\ # K2. Below it is shown the con- 
nected sum of the trefoil knot K\ (configuration 3i in 
Knot Tables) with its mirror image K2, giving rise to 
the 6-crossing 'granny' knot. 




Ki#K 2 



The Dowker-Thistlethwaite (DT) notation (or code) 
is defined for oriented knots and assigns to each pla- 
nar diagram its (minimal) DT sequence. Given for 
instance an oriented alternating knot with % cross- 
ings (namely a diagram with an alternating sequence 
of over and under-crossings) the associated DT se- 
quence is built iteratively: i) start labeling an ar- 
bitrarily chosen crossing with 1; ii) then, follow- 
ing the given orientation, go down the strand to 
the next crossing and denote it by 2; iii) continue 
around the knot until each crossing has been num- 
bered twice. Thus each crossing is decorated with a 
pair of even/odd positive numbers, running from 1 to 
2%, as shown below for the knot listed as 5i. 




For generic, non-alternating prime knots (which ac- 
tually appear in tables for crossing numbers greater 
than 7), the DT coding is slightly modified by making 
the sign of the even numbers positive if the crossing 
is on the top strand, and negative if it is on the bottom 
strand. Since any sequence is dependent on both a 



minimal projection and the choice of a starting point, 
the mapping between knots and their DT sequences 
is in general one-to-many. In the following section a 
new type of encoding which overcome these ambigu- 
ities is proposed. 



2 KNOT MOSAICS AND THEIR 
BLOCK ENCODING 

Kauffman and Lomonaco introduced in 
(Lomonaco & Kauffman, 2008) a mosaic sys- 
tem -made of eleven elementary building blocks- 
with the aim of addressing what they call 'quantum 
knots', namely quantum observables arising in the 
framework of 3 -dimensional topological quantum 
field theories. The prototiles we are going to employ 
here are a subset of Lomonaco-Kauffman mosaics 
which suffices to reconstruct the cores of diagrams 
of (prime or composite) knots on the basis of purely 
combinatorial rules to be addressed in the following 
section. 

Let fAf( 8 ) denotes the ordered set of eight knot mo- 
saics (prototiles) mi, m2 , m3, m^. ms, m^. mi, m% de- 
picted in Fig. Q] Similarly to what happens in tiling (a 
portion of) a plane with a given set of prototiles, the 
single mosaics will be assembled as they stand (nei- 
ther rotation nor reflection allowed). Note however 
that, unlike most commonly used tiling prescriptions, 
the set that is being used here is closed under rotations 
of the single mosaics (the most economical set would 
include just mi, mi, m^, but then rotations should be 
allowed). 



ml 
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m4 



m5 




m8 



Figure 1: The eight knot prototiles. 

These objects can be associated with digital se- 
quences through encoding maps fW( 8 ) — » {0, 1}* that 
can be chosen in many different ways (Pless, 1982). 
For instance the code space Z( 3 ) := {0, l} 3 of 3 -bit se- 
quences would provide a very simple (but not fault- 
tolerant) one-to-one encoding of the eight mosaics. 



Variable-length codes do not seem particularly suit- 
able in the present context, where each mosaic is in 
principle on the same footing as each other, and the 
encoding of long sequences of tiles would become 
overwhelming. To achieve a sufficient degree of re- 
dundancy (the basic requirement of any fault-tolerant 
coding protocol) still keeping a block design, consider 
the injective map 

<£ : fW( 8) Z (4) :={0,1} 4 (1) 
defined by the correspondences given in Table Q] 

Table 1: Encoding of the eight knot mosaics into 4-bits 
strings 



m\ 


M2 


m 3 


m 4 


0000 


0101 


1010 


1111 


ms 


m 6 


mj 


m 8 


0011 


0110 


1001 


1100 



The valid words in the code space E( 4 ) are a sub- 
set characterized by the property of being identical 
to the eight sequences of the binary Reed-Muller 
code ^(1,2). Mutual Hamming distances between 
these codewords are easily evaluated: d(mi,m 4 ) = 
d{mi^mz) = d(ms,m^) = d(m^,mj) = 4, and all oth- 
ers are equal to 2. The minimal distance associated 
with the encoding (Q]) is 

^min 

[£(%)) c£ (4) ] =2, (2) 
thus providing a random error detection ability equal 
to 1 (a single bit-flip cannot turn one codeword into 
another). 

In order to carry out the assembling of knot mo- 
saics, the empty prototile (blank tile) has to be added 
and suitably represented in the codespace Z( 4 ) . Ac- 
tually, as will be described in the following section, 
a single blank tile does not suffice to achieve redun- 
dancy, but rather four empty mosaics endowed with 
double arrows are needed. Denoting by $( 4 ) the or- 
dered set of the four mosaics b\, Z?2, £3, £4, the do- 
main of the encoding map is extended to 

<£ : %U% } -> Z (4) , (3) 
where the b's are associated with previously unas- 
signed codewords according to the list in Table 12 

It can be easily checked that the distances among 
Z?'s are all equal to 2, namely 

dmin [£(%)) CE (4) ] =2, (4) 
while distances between a mosaic m/ (i= 1,2, . . . , 8) 
and a blank tile b a (a = 1,2,3,4) amount to either 
1 or 3. The particular correspondences in Table |2] 
are chosen in order to maximize distances to partic- 
ular types and pairings of m's which are placed in the 
boundary layer of an N x N mosaic (cfr. diagrams in 
the following section). 



Table 2: Encoding of the four blank mosaics 



bi 


bi 
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b 4 


1000 


0010 


0100 


0001 















3 ENCODING PROCESS OF 
DIAGRAMS INTO NxN 
MOSAICS 

As a first instance of what is meant by an assem- 
bled knot diagram made out of m and b tiles, in Fig. [2] 
the composite 6-crossing granny knot already shown 
in section Q] is depicted. 




Figure 2: The mosaic of the granny knot. 

This rectangular 6x4 mosaic can be completed 
with two more rows of blank tiles to get a 6 x 6 square 
and, as can be easily checked, also all 6-crossing 
prime knots can be arranged into such a square by 
suitably combining the m-type and blank tiles, see 
Fig. IHO (recall that there are exactly three prime 
knots with 6 crossings, listed as 61, 62, 63 in Knot 
Tables). 




Figure 3: The mosaic of the 6\ knot. 



Figure 4: The mosaic of the 62 knot. 
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Figure 5: The mosaic of the 63 knot. 



While the above examples can be handled quite 
easily, in case of a generic diagram of some prime 
knot K with %(K) crossings, global combinatorial 
rules are needed to reconstruct (and coding) the as- 
sociated mosaic. Note first that the extension of the 
square (rectangle), not known a priori, can be eval- 
uated since any tile containing a crossing (mi,m4 of 
Fig. Q]) is topologically interconnected to eight tiles 
surrounding it. Then an upper bound on the size of an 
N x M mosaic is given by 

NxM < 8%, (5) 

so that the operation of converting any standard knot 
diagram into a mosaic can be efficiently performed. 

Focusing on square mosaics, since their assem- 
bling must proceed with no reference to the size of 
the resulting table, it is worth starting from an inter- 
nal tile and following a spiral path, moving e.g. in the 
clockwise direction, as shown in Fig. [6] for a 6 x 6 
mosaic. 

As for blank tiles, placed at the corners of 6 x 6 
mosaics in Fig. El SI their decorations with double 
arrows introduced in Table |2] can now be explained. 
Thus b\ must be used to fill the empty squares around 
the upper right corner, b^ around the lower right, £3 
around the lower left, and b\ around the upper left. 
Referring, e.g., to b\ in connection with Fig. [3] both 



Figure 6: The clockwise spiral path starting in S and ending 
in E for assembling prototiles of the 6-crossing knot dia- 
grams into 6x6 mosaics. 

arrows of tile b\ are activated in the empty square lo- 
cated at the upper right corner; the rightward arrow 
agrees with the spiral pathway one mosaic left to the 
corner and the downward arrow agrees with the spiral 
pathway one mosaic below the corner. 

Before going through an analysis of topological 
prescriptions which will further enforce the coding 
procedure with respect to fault tolerance, it is nec- 
essary to extend the encoding map © to deal with 
N x N mosaics. Denoting by a * the set of all words 
based on the two alphabets (12 knot tiles and 16 4-bit 
sequences) define 

: (« (4) U^ (8) r -»• % (6) 

where accepted codewords (of length AN 2 bits) are 
those associated with knot mosaics that can be ar- 
ranged into the given square. 

The topological (combinatorial) prescriptions that 
have to be taken into account traveling along the spi- 
ral encoding path of a given N x N knot mosaic are 
summarized as follows. 

i) The knot is a continuous closed path (over and 
under-crossing points are artifacts due to the fact 
that we deal with a planar projection) and thus 
each mosaics added to the previous one must 
match correctly the knot strand. In other words, 
any arrangement of mosaics giving rise at some 
point to disconnected arcs or lines is forbidden. 

ii) Most critical situations may occur at the crossings 
points (knot mosaics m\ and m^) because an ac- 
cidental swap would change the topology of the 
knot. The encoding given in section [3 Table Q] is 
such that d(m\ , m±) = 4 and thus this type of error 
is actually highly suppressed. 



iii) Away from crossing points, but still in the core re- 
gion of the mosaic, another kind of mismatching 
can occur whenever a double-arc tile (m^mj) is 
turned accidentally into a single-arc one {m<i , m-$ , 
m^^m%)\ then either a discontinuity (see prescrip- 
tion i)) or an improper closure of the knot string is 
created. In the latter case the resulting configura- 
tion would correspond to a link, namely a multi- 
component knot, contrary to the basic assumption 
which must hold true in the knot-based crypto- 
graphic protocol. 

iv) Finally, going through the most external layer of 
the mosaic, accidental swaps could occur between 
single-arc tiles, between the latter and blank tiles 
and between blank tiles. In all these situations dis- 
connected patterns must be ruled out again on the 
basis of i) (recall also that the minimum distances 
among the m's and among the b's is 2). The en- 
coding prescription for the blank tiles (Table 0> 
together with the observation that ra-tiles are ar- 
ranged in pairs in the boundary layer {m^-mi, m^- 
mg m%-m$, m$-m^) ensure that distances between 
anyone of these m and the two admissible contigu- 
ous blank tiles are equal to 2. 



prove) this conjecture, which could have interesting 
consequences also for open problems in topological 
knot theory. Recall that Wang tiles have not only a 
foundational interest in logic and in information the- 
ory, but are used also in applied computer science, see 
e.g. (Cohen et al., 2003) in connection with image and 
texture generation. 

A second remark resorts to the observation that 
the mosaic system is actually an alphabet, as the map- 
ping © suggests. Large knot mosaics, with varying N 
and embedded knotted curves, might be used, in turn, 
to modeling and encoding large sets of data. Once 
shown that the procedure described in the previous 
section provides a sort of 'topologically-protected' 
encoding, it can be argued that such further extensions 
could define a new efficient method for data transmis- 
sion. 



4 CONCLUSIONS AND 
OUTLOOK 

It has been shown that the mosaic encoding of 
the knot-based cryptographic protocol proposed in 
(Marzuoli & Palumbo, 201 1) is efficient (with respect 
to increasing complexity of knot diagrams) and ro- 
bust against random 1-bit flips of the encoded string 
of AN 2 bits. Such procedure can be applied to both 
prime knots in standard Knot Tables and composite 
knots used in the protocol. The rules described in 
the previous section, in particular the spiral pathway 
in the N x N mosaic and the connection property i), 
enforce fault-tolerance since are related to topologi- 
cal, global features: most probable errors would turn 
connected knot diagrams into collections of tiles still 
joined together but not corresponding to a connected 
knotted curve. 

The system of knot mosaics, introduced in 
(Lomonaco & Kauffman, 2008) and used here for 
specific encoding purposes, might be employed in at 
least two more contexts. The first one is related to 
the fact that they are 'prototiles', so that it would be 
interesting to ask whether they constitute a Wang set, 
namely if they are able to generate aperiodic tiling of 
the plane (Grunbaum & Shepard, 1987). It does not 
seems so, but work is in progress to improve (or dis- 
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APPENDIX 

As is well known most RSA-type protocols are 
based on the computational complexity of factoriza- 
tion of prime numbers, because the generators are 
two large prime numbers (p and q) and the public 
key is the product of them (N = pq). Once given 
N, decrypting the message needs the knowledge of 
its prime factors, and this is of course a computation- 
ally hard problem. Note however that public key al- 
gorithms are very costly in terms of computational 
resources. The time it takes the message to be en- 
coded and decoded is relatively high and this is actu- 
ally the main drawback of (any) asymmetric decod- 
ing. This problem can be overcome or even solved 
by using a symmetric key together with the asymmet- 
ric one, as done in (Marzuoli & Palumbo, 2011) for 
the knot-based cryptosystem. The following brief re- 
view refers to the original formulation based on the 
DT coding. The translation in terms of the (most re- 
liable and falt-tolerant) mosaic encoding proposed in 
this paper would be straightforward. 

A sender A must prepare a secret message for the 
receiver $ and they share the same finite list of prime 
knots K's. The message M will be built by resorting 
to a finite sequence of (not necessarily prime) knots 
L\ , ...,Ln according to the following steps. 

I) Through a standard RSA protocol, *B sends to A 
an ordered sublist of N prime knots taken from 
current available Knot Tables, K\ , . . . , Kn, together 
with mutation instructions to be applied to each 
K t . (The operation called 'mutation' amounts to 
remove a portion of the knot diagram with four 
external legs, replace it with the configuration ob- 
tained by rotating the original one, and then gluing 
back the tips of the strands.) 
A second list K[ , . . . , K' N is generated by picking up 
definite mutations of the original sequence. 

II) A takes K[,...,K' N and performs a series of or- 
dered connected sums 

L\#K[ , L2#K^ . . . ,Ln#K' n 

with the knots L\ , associated with the mes- 
sage to be sent. 

These composite knots are now translated (ef- 
ficiently) into Dowker-Thistlethwaite sequences 
and sent to *B . Obviously at this stage everyone 
has access to these strings of relative integers. 

Ill) <B receives the (string of) composite knots. Since 
he knows the DT sub-codes for the prime knots 
of the shared list, he can decompose the compos- 
ite knots, thus obtaining the DT code for every 
Li. Then the planar diagrams of Li, ...,L# can be 
uniquely recovered. 



Basically we are using in the protocol both a pub- 
lic key (step I) and a private key (step II). In fact the 
message is encrypted (by A) and decrypted (by (B) 
using the same key, the sequence of prime knots that 
they share (secretly) thanks to step I). 



